A transient Debian/Ubuntu mirror fetch aborts a docker build layer with exit 100 (it killed the web-app-nextcloud swarm openldap build while the same image built fine elsewhere). New lint under tests/lint/docker/dockerfile/apt/ flags any RUN with apt-get update/install that omits Acquire::Retries; retrofit all 15 apt Dockerfiles with -o Acquire::Retries=3. Both apt lints move into the apt/ subpackage. dnf retries by default and apk has no equivalent flag, so both stay out of scope.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The odoo config pins db_name with list_db=False, so on an empty schema
odoo preloads that database at boot, crashes (KeyError 'ir.http',
relation ir_module_module does not exist) and never binds its port; the
swarm converge wait then deadlocks because the healthcheck can never
pass and 01_init_database only runs after convergence.
Wrap the image entrypoint: probe the schema via psycopg2 against the
mounted odoo.conf, install the core modules once when absent, then hand
off to the stock entrypoint so the server boots healthy on the first
attempt. Proven live: a container against a fresh postgres installs
base and serves /web/health 200. Compose is idempotent (schema present
-> skip). The entrypoint file/paths come from a single ODOO_ENTRYPOINT_
SCRIPT_FILE SPOT (host abs/rel + docker dest), built via the same
build-arg pattern as web-app-suitecrm.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The manager-local /mnt/custom-addons host bind was rejected on swarm workers. Bake files/addons into the odoo image so every node has it, and relax the config mount mode for the non-root odoo user.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Move `rm -rf /var/lib/apt/lists/*` before `apt-get update` in every
Debian-based Dockerfile so a stale base-image-baked InRelease
(Valid-Until expired) cannot abort the build layer with exit 100. The
trailing rm at end-of-RUN never ran because `apt-get update` aborted
first; the leading rm forces a fresh fetch from the configured source.
Affected: moodle, bridgy-fed, bookwyrm (2 RUN), postmarks, taiga
backend, svc-db-openldap, svc-db-postgres, jenkins, joomla, mediawiki,
odoo, suitecrm (2 RUN), wordpress.
Add tests/lint/docker/dockerfile/test_apt_update_purge_lists.py to
enforce the contract repo-wide: every `RUN` containing `apt-get
update` MUST `rm -rf /var/lib/apt/lists/*` first in the same RUN, and
MUST NOT pass `Acquire::Check-Valid-Until=false` (which would silence
apt's replay-protection rather than refresh the list).
Rename roles/web-app-taiga/templates/Dockerfile.{back,front}.j2 to
Dockerfile.{backend,frontend}.j2 and update the matching tasks/
main.yml template refs.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- Remove unused BIBER env assertions from playwright.spec.js
- Pin pip package versions in Dockerfile for reproducible builds
- Use parameterized SQL queries in 04_ldap.yml to prevent injection
kevinveenbirkenbachandClaude Opus 4.8
evangelostsak